Visible to the public Behavioral Malware Classification Using Convolutional Recurrent Neural Networks

TitleBehavioral Malware Classification Using Convolutional Recurrent Neural Networks
Publication TypeConference Paper
Year of Publication2018
AuthorsAlsulami, B., Mancoridis, S.
Conference Name2018 13th International Conference on Malicious and Unwanted Software (MALWARE)
Keywordsanti-virus systems, anti-virus vendor naming schemes, behavioral malware classification, behavioral malware classifiers, behavioral malware detection, computer viruses, convolutional neural nets, convolutional recurrent neural networks, feature extraction, Human Behavior, invasive software, Malware, malware classification, Metrics, Microsoft Windows, Microsoft Windows Prefetch files, pattern classification, Prefetching, privacy, pubcrawl, Radio frequency, recurrent neural nets, Recurrent neural networks, resilience, Resiliency, static signature, Training
AbstractBehavioral malware detection aims to improve on the performance of static signature-based techniques used by anti-virus systems, which are less effective against modern polymorphic and metamorphic malware. Behavioral malware classification aims to go beyond the detection of malware by also identifying a malware's family according to a naming scheme such as the ones used by anti-virus vendors. Behavioral malware classification techniques use run-time features, such as file system or network activities, to capture the behavioral characteristic of running processes. The increasing volume of malware samples, diversity of malware families, and the variety of naming schemes given to malware samples by anti-virus vendors present challenges to behavioral malware classifiers. We describe a behavioral classifier that uses a Convolutional Recurrent Neural Network and data from Microsoft Windows Prefetch files. We demonstrate the model's improvement on the state-of-the-art using a large dataset of malware families and four major anti-virus vendor naming schemes. The model is effective in classifying malware samples that belong to common and rare malware families and can incrementally accommodate the introduction of new malware samples and families.
Citation Keyalsulami_behavioral_2018